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ABSTRACT 

The AUP24 audit risk model defines audit risk implicitly as the joint probability 
of three independent events: (i) a material error occurring in an account 
balance, (ii) that error not being corrected by internal control procedures, 
and (ii) the uncorrected balance being accepted by the auditor. A more 
apposite risk measure, relating to these same possible events, is the 
conditional probability of a materiakerror given that the stated balance has 
been subject to internal control procedures and accepted by the auditor. 
The two risk measures so defined are related by the laws of probability, 
through Bayes' theorem specifically, but are not the same and exhibit no 
necessary correlation. Calculation of the conditional (‘Bayesian’) risk measure 
requires consideration of both the type | (alpha) and type | (beta) error 
probabilities of the auditor's substantive test procedure. Unless both error 
characteristics are taken into account, it is not possible to interpret a test 
result (acceptance or rejection) in terms of the probability of the stated 
account balance being materially correct. 


1. Introduction 

AUP24 describes audit risk as '...the risk (complement of assurance) that the 
conclusions drawn from the audit process might be invalid’ (para. 16). This 
risk, or lack of assurance, exists through the conjunction of (para. 10): 


(i) the ‘inherent risk' that error may occur in the auditee's accounts, 


(ii) the ‘control risk' that the auditee's internal control system may not 
reveal (and correct) an error occurring inherently 


(iii) the ‘detection risk' that the auditor's test procedure may not 
reveal an error not corrected by the internal control system. 


For an error to arise and remain in the accounts, the events described in (i), 
(ii) and (iii) must occur jointly (i.e. in conjunction). If no error occurs inherently, 
or any error occurring is corrected by internal control procedures, or the 
auditor detects and corrects any error not already corrected, the chain is 
broken and no error will 'get through’ into the audited accounts. Note, 
however, that this does not preclude the possibility that the audit process 
itself might introduce a falsity into the accounts through a type | (‘alpha’) error 
(rejection of a materially correct balance) and consequent material 
‘correction’ of that incorrectly rejected balance. 


2. Notation 

To model the relationship between audit risk and its underlying sources, 
inherent risk (IR), Control risk (CR) and detection risk (DR), each of these risk 
terms is defined as a probability. The notation used is as follows: 


- letter e denotes the occurence of a material error in the stated 


account balance. 


- letter i means that an account balance withstands internal control 


procedures without being seen to require correction. 


-letter a means that following a well specified substantive test 


procedure the auditor accepts the stated balance. 


We can now write 


(D IR=p(e)=the probability of an error occurring inherently in the 


balance stated. 


(i) CR=p(ile)=the probability of internal control procedures not 
leading to correction of an account balance given a material error 


in that balance. 


(iii) DR=p(ale,)=the probability of the auditors' test procedure 
accepting a stated balance given that this balance is both | 
inherently in error and uncorrected by internal control procedures. | 


3. Audit Risk Defined 
The risk model adopted in AUP24 (Appendix IV) represents audit risk as the 
product of the three component risks IR, CR and DR; that is 


AR = IR x CR x DR. 
In terms of probabilities, AR is then 
pce) x p(il e) x p(al e, i) (1) | 


which is a mathematical expansion of the joint probability, p(e,i a). Thus AR is | 
defined implicitly as the probability of an error occuring and no correction by | 
the internal control system and acceptance by the auditor. Usually it is i 
supposed that internal control procedures and audit testing are statistically 
independent, in which case p(al e./)=p(al e); cf. Cushing and Loebbecke 
(1983, p.30). In the terminology of statistical hypothesis testing, p(al e) is the 
probability of a type Il (beta) error (i.e. acceptance of a materially incorrect 
balance). Under the assumption of independence, expression (1) simplifies to 


p(e) x p(ile)xp(ale). (2) 


Although the AUP24 risk measure has a straightforward mathematical 
interpretation, its representation of audit risk (AR) as the joint probability 
p(ei.a) is curious. The probability which represents properly the auditor's 
degree of assurance (confidence), after the audit is completed, in the stated 


balance, is 
1-p(e | 1a), 


or, alternatively, audit risk (being the complement of assurance) is 
represented by the conditional probability 


p(e | ia): 


Defined this way, audit risk is the probability of an error in the stated balance 
given that this balance has been subject to internal control procedures and 
has been accepted by the auditor. The mathematical specification of audit 
risk as the Conditional probability p(e| ia), rather than as the joint probability 
p(ei.a), is supported by the textbook interpretation of Arens et al. (1984, 
p.244): 


Audit Risk Risk that a given segment (balance) is materially 
misstated after the audit is completed and the auditor has 
concluded thot the segment is materially correct. 


4. Relationship Between p(eli,a) and p(e,i,a) 
By Bayes' theorem, the relationship between the advocated measure of 
conditional audit risk, p(e | ic), and the AUP24 measure, p(e,i,a), is 


pelia) = Kara QB) 


p(e,i.a) + p(-e,i d) 


peia 


N a 


peia + p(~e) p(il ~e) p(al-e.i) 


where ~ is the negation operator, and thus -e denotes not-e (i.e., no material 
error in the stated balance). From this equation, it is seen that although 
p(e | ia) is a function of the AUP24 risk measure, p(e,/,a), this latter probability 
is not an appropriate end in itself when evaluating audit risk. Moreover, to 
oroduce the requisite conditional probability of material error, it is necessary 
to allow for two further probability factors: 


(iv) p(il~e)=the probability of an account balance which is 
materially correct withstanding internal control procedures without 


(material) 'correction', and ` 


(v) p(al-e.i)=p(al-e)the probability of an account balance 
which is materially correct being accepted by the auditor's test 


procedure. 


The first of these probabilities, plil ~e) is assumed to be one, since ideally the 
internal control system will correct, but not introduce, errors. That is, a 
materially correct balance will not be altered materially. The second 
probability, p(al~e) is equal to 1-p(~al~e), where p(~a|~e) represents the 
probability of the auditor's test procedure not accepting (i.e. rejecting) a 
correct balance. In hypothesis testing terminology, (~al ~e) is the probability 
of a type | error (i.e., rejection of a materially correct balance). It is seen, 
therefore, that the advocated conditional risk measure, plela}, takes 
account implicitly of both the type | and type Il error probabilities of the 
auditor's test procedure. 


The AUP24 risk measure builds in consideration of p(al e), the type Il (beta) 


error probability (see expression (2)), but not the other of the two operating 
characteristics of the auditor's test procedure, p(~a|~e). Although this widely 


ee eh 


accepted measure may often yield a figure for audit risk foirly close to The 
conditional probability p(elia), it will sometimes understate that more 
appropriate measure by a factor of four or more. This will tend to be the case 
when inherent risk p(e) is high and/or the type | error probability, p(~a!| ~e), is 
high (see Figure 2 below). 


To demonstrate the possible divergence between the conditional or 
‘Bayesian’ risk measure, p(el ia), and the AUP24 construct p(e,i.a), consider 
the example calculations provided in AUP24 (Appendix IV, para. 8). Here, it is 
taken for the purpose of exposition that inherent risk p(e) equals .75, control 
risk p(ile) equals .3 and detection risk p(ale) equals .22. These assumed 
values lead to an AUP24 audit risk measure of ple,La)=.75 x .3 x .22 = .05. Now 
consider the more relevant, conditional risk measure p(e | ia), which equals, 
from (3) ` 


05 / (.05 + (1-p(e)) (1-p(~al ~e))} = .05 / (3 - .25 p(-al-e)). 


Values of this function of the type | error probability, p(~a| ~e). are shown in 


Figure 1. 


FIGURE 1 ABOUT HERE 


Note, for example, that for a type | error probability of .4, the conditional 
audit risk p(e | ia) equals .05 / {.3-(.25)(.4)}=.25 or 25%, which is five times the 
AUP24 measure. At the very least, when p(~al~e)=0 (see section 6 below), 
p(e|i.a)=.05/.3=.17 is more than three times the conventional measure. In the 
extreme, the type | error probability p(-al-e) equals one and p(elia) is 
05/.05=1 or 100%, regardless of the value of inherent risk ple). These 
disparities demonstrate clearly the importance of considering both type | and 
type Il error probabilities, rather than the latter only as per AUP24. Figure 2 
shows a contour plot or "topographical map" of the conditional risk p(e | ia) 


as a function of both inherent risk, p(e), and type | error probability, p(-al-e). 
The contours ('iso-risks”) shown have values 105, .1, i De aer ae sacs, 8, .9, going 
from left to right (or from light to dark). For example, it can be seen from 
Figure 2 that for p(e)=.6 and p(-a | ~e)=.8, p(e | ia) equals about .3 or 30%. 


FIGURE 2 ABOUT HERE 


5. Conclusion 

The auditors assurance or level of confidence in an audited account balance 
is properly represented by the probability of that balance being correct 
conditional on it having been subject first to internal control procedures and 
then to substantive testing. Alternatively, the complement of audit 
assurance, audit risk (AR), is the probability of an error in the audited balance 
given the internal control procedures and tests carried out by the auditors. 
This probability is written mathematically as p(e | ia), and is a function of both 
the type | and type Il error probabilities of the auditor's substantive test 
procedure.! By comparison, the AUP24 measure of audit risk is the joint 
probability p(e,i.a), which although related to p(elia) through the laws of 
probability, is not the same as that probability, and is of little interest per se. 


If auditors require a logically and mathematically valid quantitative 
assessment of audit risk, the AUP24 model must be extended to measure the 
conditional probability p(elia) rather than merely its mathematical 
‘component’, the joint probability p(e.ia). Without this revision, auditors’ 
reliance on the AUP24 model is not well based in probability theory. From a 
logical perspective, the AUP24 risk measure is useful only in that it is 
calculated as one step toward finding what is really required, namely a 
measure of confidence in the reported balance conditional on the internal 
control procedures and substantive tests (statistical or otherwise) which that 
balance has withstood beforehand. 


6. Postscript: The Canadian (CICA) Model 
In a research study of the Canadian Institute of Chartered Accountants (1980, 
0.97) 'overall audit risk! is specified mathematically as 


joint risk 
eo E= > l u= == 
joint risk + inherent confidence 


where joint risk! refers to the AUP24 audit risk measure - i.e. the joint probability 
p(e,ia) - and ‘inherent confidence’ is the probability, p(~e)=1-p(e), of no 
inherent error in the balance tested. This mode! is Bayesian, and is as 
advocated above, except for its implicit assumption that the type | error 
probability is zero. To see this assumption, note from (3) that the CICA model 
presumes that p(~e,i.a)=p(~e), thus requiring that both p(il ~e) and p(al-e) 
equal one, and by implication, that the type | error probability p(-al-e) 
equals zero. 


The basis for the assumption of a zero type ! error probability is that in 
practice a materially correct balance which is initially rejected by audit 
testing will ultimately, perhaps after further sampling, be accepted without 
material alteration. On this assumption, type | errors occur but do not endure, 
and are therefore merely 'efficiency' errors, having only the legacy of the 


costs incurred in their revelation. 


Footnotes 


1. Further discussion on this point, although in the context of interpreting test 
results in empirical research rather than in auditing, can be found in 
Burgstahler (1987). A more technical paper, Johnstone and Lindley (1994), 
extends this discussion. Similarly, on the Bayesian probabilistic interpretation 
of test results in audit sampling, see Johnstone (1994). 
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Headings for Figures 


Figure 1: Bayesian Audit Risk Given Inherent Risk of .75 


Figure 2: Contour Plot of Bayesian Audit Risk as q Function of Inherent Risk 
and the Type | Error Probability of the Auditor's Test Procedure. 
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